Is lithium-fabric-0.21.4_mc1.21.11.jar Safe? JAR Virus and Malware Scan Report

[!WARNING] Final verdict available at the end of this report.

What This JAR Scanner Found

This JAR scanner inspected all 687 classes in lithium-fabric-0.21.4_mc1.21.11.jar, including decompiling every class successfully. It found seven classes with generic security-relevant indicators: file access, Java reflection, or Java class-loading APIs. It also found three archive files containing external web links.

The file-related findings are concentrated in Lithium configuration and Fabric game/config-directory handling. The reflection and class-loader findings are in utility and service-loading code, which can be normal for a Fabric mod that needs to integrate with different Minecraft/runtime environments.

The URLs found point to the Lithium project’s GitHub pages, its project page, Oracle documentation, and the Free Software Foundation website. These are hardcoded documentation or project links in metadata/configuration material; the report does not show that the mod makes unexplained network connections to them.

Questions the Full Report Answers

• Does the mod contain signs of credential theft, hidden downloads, or destructive commands?
• Are the flagged file-access calls related to Minecraft and Lithium configuration?
• Do the reported external URLs appear to be normal project and documentation links?
• Are reflection and class-loading APIs used in core mod compatibility code rather than remote-control code?
• How much of the JAR was successfully inspected?

Malware and Virus Findings

No high-signal malicious behavior was detected.

The scan does not report evidence of credential or token theft, browser-data collection, hidden payload downloads, process execution, persistence mechanisms, destructive file deletion, remote command execution, or data exfiltration. It found file-access APIs, but the identified methods are related to loading/writing Lithium configuration and retrieving the game or configuration directory.

The report includes external URL literals, but these point to public project, issue-tracker, license, and documentation pages. A URL stored in a JAR is not the same as proof that the JAR contacts that URL.

RAT Detection

The evidence is not consistent with a remote-access trojan (RAT).

There are no reported indicators of remote control, shell/process launching, command execution, hidden download-and-run behavior, persistence, or credential collection. The reflection and class-loader usage deserves normal code review attention, but the named classes suggest ordinary mod compatibility and service-loading functions rather than RAT behavior.

Suspicious Classes and Evidence

Core JAR or Mod Code

Class	Severity	Behavior	Evidence
net.caffeinemc.mods.lithium.common.config.LithiumConfig	Low	Reads or writes a Lithium configuration file	load(File) uses Java file APIs; writeDefaultConfig(File) contains a GitHub wiki configuration URL
net.caffeinemc.mods.lithium.common.reflection.ReflectionUtil	Low	Uses reflection to inspect whether methods are overridden	hasMethodOverride(...) uses Java reflection APIs
net.caffeinemc.mods.lithium.common.services.PlatformRuntimeInformation	Low	Uses Java NIO file/path APIs	File-access indicator only; no destructive action reported
net.caffeinemc.mods.lithium.common.services.Services	Low	Loads platform-specific services	load(Class<T>) uses a Java class-loader API
net.caffeinemc.mods.lithium.common.util.ChunkConstants	Low	Uses reflection during static setup	Reflection API in the class initializer
net.caffeinemc.mods.lithium.fabric.FabricRuntimeInformation	Low	Retrieves Minecraft game and config directories	getGameDirectory() and getConfigDirectory() use Java NIO paths
net.caffeinemc.mods.lithium.mixin.LithiumMixinPlugin	Low	Accesses files while loading the mixin plugin/configuration	onLoad(String) uses Java file APIs

These findings are all in Lithium’s own code, but their class and method names give them clear, expected purposes: configuration handling, Fabric runtime integration, platform service loading, and Minecraft mixin support.

Bundled Third-Party Libraries

No suspicious bundled third-party library classes were identified in this report.

The scan did not flag common shaded-library patterns such as metrics, database drivers, logging libraries, or HTTP clients. The reported URLs are in project metadata, documentation, or configuration-related content rather than a bundled networking component.

Network Activity

The report found hardcoded URL text for the following public sites:

• https://jellysquid.me/projects/ — Lithium project page
• https://github.com/CaffeineMC/lithium-fabric — Lithium source repository
• https://github.com/CaffeineMC/lithium-fabric/issues — Issue tracker
• https://github.com/CaffeineMC/lithium-fabric/wiki/Configuration-File — Configuration documentation
• https://docs.oracle.com/... — Oracle documentation link
• https://fsf.org/ — License-related link

No IP addresses, unknown domains, webhook endpoints, paste sites, download servers, command-and-control hosts, or credential-collection endpoints were reported.

The scanner’s “HTTP URL literal” indicator means that URL text exists in the archive. It does not prove the mod sends network requests or transmits data to those locations.

Deobfuscation and Analysis Coverage

Analysis coverage was strong:

• Classes found: 687
• Classes parsed: 687
• Classes decompiled: 687
• Parse failures: 0
• Decompiler failures: 0
• Decompiler anomaly classes: 0
• Methods containing code inspected: 2,252

There are no reported decompiler anomalies, unreadable classes, or signs that important code was hidden from static inspection. The report did identify reflection and class-loader APIs in three locations, which are harder to review automatically, but the surrounding class names and methods appear consistent with normal mod/platform functionality.

Is This Minecraft Mod Safe?

This is a Fabric Minecraft mod JAR: lithium-fabric-0.21.4_mc1.21.11.jar.

Lithium is expected to interact with the Minecraft installation directory, its configuration directory, and Fabric’s runtime environment. File access in those areas is normal for a performance and configuration-focused mod. Its use of mixins, reflection, and service loading can also be required to work across Minecraft and Fabric internals.

The report does not show behavior commonly associated with a malicious Minecraft mod, such as stealing launcher credentials or Discord tokens, modifying unrelated user files, installing itself persistently, downloading extra JARs, or accepting remote commands.

What Looks Normal

• Reading and writing Lithium configuration files.
• Retrieving the Minecraft game directory and config directory.
• A configuration wiki URL embedded in configuration-related code.
• Links to Lithium’s GitHub repository, issue tracker, and project website.
• Reflection for compatibility checks, such as checking whether a Minecraft method was overridden.
• Java class-loader use to select Fabric/platform-specific implementations.
• Mixin plugin initialization, which is standard in many Fabric mods.
• Complete successful decompilation with no anomaly flags.

What Is Dangerous

No major red flags were found in this report.

The only unresolved limitation is that static analysis cannot fully establish what happens at runtime. Reflection and dynamic class loading can make automated inspection less direct, but this report ties those features to clearly named Lithium runtime, service, and compatibility classes rather than suspicious remote-control or payload-loading code.

What Should You Do?

• Verify the SHA-256 hash if you downloaded the JAR from a source that publishes official hashes: 5135c41da5b43cbdcb29424bde65195143ac4084e23834c8eac065942201c78b.
• Prefer downloading Lithium from its official project page, trusted mod platforms, or its official GitHub releases.
• Keep Fabric, Minecraft, and Lithium versions compatible.
• If the JAR came from an unofficial reupload, compare its filename, version, and hash with the official release before installing it.
• As with any mod, keep backups of important worlds and server files.

Scan Limitations

Static JAR scanning reduces risk by inspecting classes, methods, embedded URLs, and common suspicious APIs, but it cannot prove a file is completely safe. A scan cannot fully predict runtime behavior, changes made by a compromised dependency, or behavior triggered only in unusual environments. Download source and hash verification remain important.

Frequently Asked Questions

Can a JAR file contain a virus?

Yes. A Java JAR can contain malicious code, including code that steals data, downloads payloads, executes commands, or modifies files. This report did not find those high-signal behaviors in this JAR.

How do I check whether a JAR file is safe?

Use a JAR malware scanner, check the download source, compare the file hash with an official release when available, and review whether flagged behavior has a sensible purpose. For this JAR, the reported file, reflection, and class-loading behavior has identifiable mod-related purposes.

Can this scanner detect a Minecraft RAT?

It can identify common RAT-related signs, such as remote command code, suspicious network destinations, hidden downloaders, process execution, persistence, and credential theft patterns. None of those indicators were reported here.

Does obfuscation mean a JAR is malicious?

No. Some developers obfuscate code for size, compatibility, or intellectual-property reasons. In this case, the scanner reported no decompiler failures or decompiler anomaly patterns.

Final JAR Safety Verdict

Verdict: Trust
Risk level: Low
Confidence: High

Should I trust this JAR, and why? The scan fully parsed and decompiled all 687 classes without anomalies, and it found no evidence of malware-style behavior such as token theft, hidden downloads, command execution, persistence, or data exfiltration. The flagged file access is tied to Lithium configuration and Minecraft/Fabric directory handling. Its reflection and class-loader usage are in named compatibility and service-loading utilities, which is normal for a Fabric mod. The external URLs are public Lithium, GitHub, licensing, and documentation links rather than unexplained network endpoints. You should still obtain the JAR from an official or otherwise trusted source and verify its hash where possible.